Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    600s
  • max time network
    487s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/06/2024, 08:15

General

  • Target

    http://uraichem.com/nc_assets/css/style.css

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://uraichem.com/nc_assets/css/style.css
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2640
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff98491ab58,0x7ff98491ab68,0x7ff98491ab78
      2⤵
        PID:4380
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1656 --field-trial-handle=1768,i,4497716177815324206,250680829886440594,131072 /prefetch:2
        2⤵
          PID:4896
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=1768,i,4497716177815324206,250680829886440594,131072 /prefetch:8
          2⤵
            PID:1744
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2276 --field-trial-handle=1768,i,4497716177815324206,250680829886440594,131072 /prefetch:8
            2⤵
              PID:5036
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2868 --field-trial-handle=1768,i,4497716177815324206,250680829886440594,131072 /prefetch:1
              2⤵
                PID:4232
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2876 --field-trial-handle=1768,i,4497716177815324206,250680829886440594,131072 /prefetch:1
                2⤵
                  PID:3612
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4536 --field-trial-handle=1768,i,4497716177815324206,250680829886440594,131072 /prefetch:8
                  2⤵
                    PID:4276
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4296 --field-trial-handle=1768,i,4497716177815324206,250680829886440594,131072 /prefetch:8
                    2⤵
                      PID:3964
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4500 --field-trial-handle=1768,i,4497716177815324206,250680829886440594,131072 /prefetch:1
                      2⤵
                        PID:4368
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4716 --field-trial-handle=1768,i,4497716177815324206,250680829886440594,131072 /prefetch:1
                        2⤵
                          PID:4844
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4688 --field-trial-handle=1768,i,4497716177815324206,250680829886440594,131072 /prefetch:8
                          2⤵
                            PID:4132
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4832 --field-trial-handle=1768,i,4497716177815324206,250680829886440594,131072 /prefetch:8
                            2⤵
                              PID:4152
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2960 --field-trial-handle=1768,i,4497716177815324206,250680829886440594,131072 /prefetch:8
                              2⤵
                                PID:4004
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4860 --field-trial-handle=1768,i,4497716177815324206,250680829886440594,131072 /prefetch:1
                                2⤵
                                  PID:2956
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=5104 --field-trial-handle=1768,i,4497716177815324206,250680829886440594,131072 /prefetch:1
                                  2⤵
                                    PID:2024
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1536 --field-trial-handle=1768,i,4497716177815324206,250680829886440594,131072 /prefetch:2
                                    2⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:4448
                                • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                                  "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                                  1⤵
                                    PID:1316

                                  Network

                                  MITRE ATT&CK Enterprise v15

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\1334897d-1afe-43c9-8e7f-a27795daa086.tmp

                                    Filesize

                                    152KB

                                    MD5

                                    cfa4569794d25da03ea55af3f0748e8c

                                    SHA1

                                    ae7508a1af4beb767947cb1a48dab4844c0ff56f

                                    SHA256

                                    7e0c64e2691e9c72a37cf0a1f2b3fa85019326f069704920a6faa11e08077660

                                    SHA512

                                    0f0cdc78b043eb4caaca94ea274e0299fb42ffca5691e0bc9306a8279715f3b3362d825b5355bddf5909f8fe2d2f84f5c0b2978476d40aff71a2f01166aab0fc

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                    Filesize

                                    72B

                                    MD5

                                    a4309cbbd9c16b973db537ea6fa9df4f

                                    SHA1

                                    6e19bdbc6236f097ac539528369c456a96215777

                                    SHA256

                                    7d909af8fcfa49812c7a45685edb7e6a570a0e4f79a14061b8b48d9796d9047c

                                    SHA512

                                    d3506b776c7784eb499f4e99068c405242fa44059631dc25f6dcb4624d98851c6c738c077d7e9fe17cb90a22ec032b749ac78e7d6e7c8ac3eb610ecaa4f0dd51

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                    Filesize

                                    852B

                                    MD5

                                    9a77b6a8b9d34c600ded3bfe9fba628c

                                    SHA1

                                    4addda10ea677d4f291acdd97539ae7d58e1ba63

                                    SHA256

                                    656f49194d9a23ff42150161186dabdd0342380a4e9c08234e68c5d6f74ca9d0

                                    SHA512

                                    3061efd17535d1513a02922b6de8e8095b400265718e3bf2cc6aeda27a28b300db6777578da0d539dbabfc61bd95b0f1949025f2f7fca7fd3fa80c28be9900b3

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                    Filesize

                                    2B

                                    MD5

                                    d751713988987e9331980363e24189ce

                                    SHA1

                                    97d170e1550eee4afc0af065b78cda302a97674c

                                    SHA256

                                    4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                    SHA512

                                    b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                    Filesize

                                    7KB

                                    MD5

                                    4474323f6f77f688a822e6c46c76c706

                                    SHA1

                                    ad0674d66a8b9366530974470ac50ad6759de2e6

                                    SHA256

                                    d27c3032ccfa850f493d86f8b3508942970a92ec6f02100b633e2f444d457d2b

                                    SHA512

                                    e94d757fa51fa88fd11329f358ccf680442afeec2f5689657546770e7f1c772514c71595aee306495b6b9a0e4bea5c8b3b2cd17afc577ad7d2a33e66b2528041

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                    Filesize

                                    7KB

                                    MD5

                                    042a9c1d17c59b9da7d9049685fba23e

                                    SHA1

                                    3b1c9d3bbd5b7802c38a2200ef9928ef965b8d44

                                    SHA256

                                    8892b991c79ebb15bb27b6cb1b258d00ad30760131ed17f51d0b32c5380d7107

                                    SHA512

                                    16378f6313f77a2ea19e7c5b8c2999885c52487c6023f79991b09a7f882b675091f18f28ed22cdcf75d3cfc6c1fcc4618767be11be14376206f253359540075d

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                    Filesize

                                    7KB

                                    MD5

                                    a3a93b9e394135c24a2e06ce91ec583a

                                    SHA1

                                    0d0e7f390e0aa8a024022d134c85d3e6e95bdff5

                                    SHA256

                                    0dc1e07a07bf9d6b58af89ad09397d9e5991311fa4e9bb697ec550a40b1e0f08

                                    SHA512

                                    55e39e457716735ed5e0145f76f3f6b0eca00c7331a96f9277a6f6d971cbea6bd37fe6cdeb1150c4f1e0f85f2b68a5f9d2ad639a6fc34bd2b6845c70b4272e6f

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                    Filesize

                                    7KB

                                    MD5

                                    1f4b553544fae10e96c358c3d29a1500

                                    SHA1

                                    9a65f5dfa54d7610644a3a2a541440d9bebf996b

                                    SHA256

                                    d87bcfb76e4cebad05f540f58b715856359b810bbd7eced4b80e20a68a69d58a

                                    SHA512

                                    2ad7d98371b033e28f8d5546d74f365260d24868a0df49e91acea7ab7865de90959ec018c4443234519fb2afe362fc07ebfcb7ea4527d9787367750f0b2e103d

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                    Filesize

                                    7KB

                                    MD5

                                    b3a048ea66b33d13301b47578875a3e8

                                    SHA1

                                    d5daa275e811abbb1871b7089d87fdb159872de0

                                    SHA256

                                    66e7cd67ed6547528724f364882dce05d864dc4379da6a60bebd22f93d882ad3

                                    SHA512

                                    957bfcff107229df3f0cf5ef6a7a2fc0fb2049682587c01f9bf0b44aa612f345bb2a14c17f6f09eea548612e36e0659ecbbbc3324a33669d22d26afea63a594a

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                    Filesize

                                    7KB

                                    MD5

                                    7e2449544b08592eb368811e24577c6b

                                    SHA1

                                    58e7bb91a6f8793b077c8cbef2e0908a6fafd3ba

                                    SHA256

                                    126d11255c0c49104a18062b62c99095ed2aa11f41b109fcfafae8ed701ad58f

                                    SHA512

                                    6b5160abaea51ca51625ad18f9e3697139d09bc823cc7ceb972fd1ced82529c97a135cfafb19afdb1c35f6e7555410a3b2677d9376e904d2daad4706fdbbb36a

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                    Filesize

                                    7KB

                                    MD5

                                    cc6e20eda0a7aaec3fb435e6cc9227a4

                                    SHA1

                                    70b78d08f0936c9a2b370bbfa1eed4cfeb31669a

                                    SHA256

                                    f38263f2b17ec0c4d711c756cf56cab69254f7d127a8798b36f5dc82697b5a49

                                    SHA512

                                    134209c9b75e68f729739b0adefa628dcdd7413806e610514af16eeafd31c826333f3dd181dbd860b60802e57e7c71f8de38dfb5f25424479716201313b96d97

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                    Filesize

                                    131KB

                                    MD5

                                    faabc1ab9898e1c63ac07191d75f375d

                                    SHA1

                                    954f01ea8e7e42e62026dfa7b19ab636e7284fa0

                                    SHA256

                                    db4d51adc64f60b0d82f7c81a48b6266b19122e43084943c465108e71870ab0b

                                    SHA512

                                    3896f15d8da93095fc07282777d4dae9d82c33409ec1df75aca80bd2cdd6c8b404122bc423958e7c0b78dea166d60f9bb4c2a8f9b8b3361db0773c5855cd1384

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                    Filesize

                                    132KB

                                    MD5

                                    9cbb39ff104c684a4707af43e446e005

                                    SHA1

                                    a1424658d07918b2811aa34e60c203c51514fd00

                                    SHA256

                                    181d30203db9d899a2fa451794afe71cbd8b5836c352dd5618a1699a18bb259b

                                    SHA512

                                    e3c94f14ce6725c3cc3d515fd998c49e14da5c29f1513833befae72e80719dea639893728379713ed7e095022ed70d253842473b11a1a2a8a020e0800634eb1f

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                    Filesize

                                    131KB

                                    MD5

                                    1f75a2222baadd6cdef8c610e146606d

                                    SHA1

                                    0f8a14a0c077a8e7cb4001d5a68510b754010095

                                    SHA256

                                    81e8e67bb2fa3c38a9cf4531c4777194208acd0e53fde6c7ddad5fb8dd83fc45

                                    SHA512

                                    131b56c438ad3c730cacfa1a2596d2e1e1e445494c09595a7af0d7bd28430b8b1fc133fd5e756f9f33429573844d7af14ca5928fcd14f07cbe8e455772370e21

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

                                    Filesize

                                    91KB

                                    MD5

                                    cd92d4a22072dab2f3c28c4bdc27144d

                                    SHA1

                                    257bcc9fbe4faf7a06a61dd8d40357bd4216f6e8

                                    SHA256

                                    cc3b14bfa93a4b3ccd8977f3c67cb76db52e59a3203afa42c65c7d1161e013c2

                                    SHA512

                                    4a0d2c7f957366366794c58e0f29c60429d96b9e0f7f495d49907a7a331bd3c665182d68b662b6c7c63d133350ebb43c5fa153204499d0bd1327c9d0bdc60e35

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe57d6e7.TMP

                                    Filesize

                                    88KB

                                    MD5

                                    c88dc77056450d0d662449a00f905f74

                                    SHA1

                                    986df4ea151954fae7b220073718aed2783b0d6f

                                    SHA256

                                    8d3c1b4098ed85067a65f77d13478a0b1d04ab143d5a204be2f5d90fb0ac6bee

                                    SHA512

                                    98d34fcca5a7b69cb5b2918ae49ecfc769162297c27aef5ac0d1338cac6ae003cdd4da7110230199cbc562efa0df6a7a02a8d8323a0eb1e39521dc0297adac07